伪装的PDFX16

显示全部楼层 · 发表于 2008-10-3 23:45:56

挂的比较惨

http://xianexs.mail.qq.com/cgi-bin/downloadfilepart/svrid246/Win32.Spy.Pachat.zip?svrid=246&fid=e75ffdf0dabc547f73704a1e7d6e2dec695e8b7acc6330fd&&txf_fid=&&txf_sid=

提取码 cfc51114

显示全部楼层 · 发表于 2008-10-3 23:49:09

这个....相信卡巴不报......有人上报给卡巴嗎?

显示全部楼层 · 发表于 2008-10-3 23:58:04

2008-10-3 23:56:12 1223049372 Silhouette 3684 Sign of "Win32:Delf-HJO [Trj]" has been found in "C:\Documents and Settings\Silhouette\桌面\Win32[1].Spy.Pachat.zip\Win32.Spy.Pachat\Win32.Spy.Pachat\pdf_100(10).scr\[ASProtect]" file.
2008-10-3 23:56:17 1223049377 Silhouette 3684 Sign of "Win32:Delf-HJO [Trj]" has been found in "C:\Documents and Settings\Silhouette\桌面\Win32[1].Spy.Pachat.zip\Win32.Spy.Pachat\Win32.Spy.Pachat\pdf_100(11).scr\[ASProtect]" file.
2008-10-3 23:56:17 1223049377 Silhouette 3684 Sign of "Win32:Delf-HJO [Trj]" has been found in "C:\Documents and Settings\Silhouette\桌面\Win32[1].Spy.Pachat.zip\Win32.Spy.Pachat\Win32.Spy.Pachat\pdf_100(12).scr\[ASProtect]" file.
2008-10-3 23:56:17 1223049377 Silhouette 3684 Sign of "Win32:Delf-HJO [Trj]" has been found in "C:\Documents and Settings\Silhouette\桌面\Win32[1].Spy.Pachat.zip\Win32.Spy.Pachat\Win32.Spy.Pachat\pdf_100(13).scr\[ASProtect]" file.
2008-10-3 23:56:17 1223049377 Silhouette 3684 Sign of "Win32:Delf-HJO [Trj]" has been found in "C:\Documents and Settings\Silhouette\桌面\Win32[1].Spy.Pachat.zip\Win32.Spy.Pachat\Win32.Spy.Pachat\pdf_100(14).scr\[ASProtect]" file.
2008-10-3 23:56:17 1223049377 Silhouette 3684 Sign of "Win32:Delf-HJO [Trj]" has been found in "C:\Documents and Settings\Silhouette\桌面\Win32[1].Spy.Pachat.zip\Win32.Spy.Pachat\Win32.Spy.Pachat\pdf_100(15).scr\[ASProtect]" file.
2008-10-3 23:56:18 1223049378 Silhouette 3684 Sign of "Win32:Delf-HJO [Trj]" has been found in "C:\Documents and Settings\Silhouette\桌面\Win32[1].Spy.Pachat.zip\Win32.Spy.Pachat\Win32.Spy.Pachat\pdf_100(16).scr\[ASProtect]" file.
2008-10-3 23:56:18 1223049378 Silhouette 3684 Sign of "Win32:Delf-HJO [Trj]" has been found in "C:\Documents and Settings\Silhouette\桌面\Win32[1].Spy.Pachat.zip\Win32.Spy.Pachat\Win32.Spy.Pachat\pdf_100(2).scr\[ASProtect]" file.
2008-10-3 23:56:18 1223049378 Silhouette 3684 Sign of "Win32:Delf-HJO [Trj]" has been found in "C:\Documents and Settings\Silhouette\桌面\Win32[1].Spy.Pachat.zip\Win32.Spy.Pachat\Win32.Spy.Pachat\pdf_100(3).scr\[ASProtect]" file.
2008-10-3 23:56:18 1223049378 Silhouette 3684 Sign of "Win32:Delf-HJO [Trj]" has been found in "C:\Documents and Settings\Silhouette\桌面\Win32[1].Spy.Pachat.zip\Win32.Spy.Pachat\Win32.Spy.Pachat\pdf_100(4).scr\[ASProtect]" file.
2008-10-3 23:56:18 1223049378 Silhouette 3684 Sign of "Win32:Delf-HJO [Trj]" has been found in "C:\Documents and Settings\Silhouette\桌面\Win32[1].Spy.Pachat.zip\Win32.Spy.Pachat\Win32.Spy.Pachat\pdf_100(5).scr\[ASProtect]" file.
2008-10-3 23:56:19 1223049379 Silhouette 3684 Sign of "Win32:Delf-HJO [Trj]" has been found in "C:\Documents and Settings\Silhouette\桌面\Win32[1].Spy.Pachat.zip\Win32.Spy.Pachat\Win32.Spy.Pachat\pdf_100(6).scr\[ASProtect]" file.
2008-10-3 23:56:19 1223049379 Silhouette 3684 Sign of "Win32:Delf-HJO [Trj]" has been found in "C:\Documents and Settings\Silhouette\桌面\Win32[1].Spy.Pachat.zip\Win32.Spy.Pachat\Win32.Spy.Pachat\pdf_100(7).scr\[ASProtect]" file.
2008-10-3 23:56:19 1223049379 Silhouette 3684 Sign of "Win32:Delf-HJO [Trj]" has been found in "C:\Documents and Settings\Silhouette\桌面\Win32[1].Spy.Pachat.zip\Win32.Spy.Pachat\Win32.Spy.Pachat\pdf_100(8).scr\[ASProtect]" file.
2008-10-3 23:56:19 1223049379 Silhouette 3684 Sign of "Win32:Delf-HJO [Trj]" has been found in "C:\Documents and Settings\Silhouette\桌面\Win32[1].Spy.Pachat.zip\Win32.Spy.Pachat\Win32.Spy.Pachat\pdf_100(9).scr\[ASProtect]" file.
2008-10-3 23:56:19 1223049379 Silhouette 3684 Sign of "Win32:Delf-HJO [Trj]" has been found in "C:\Documents and Settings\Silhouette\桌面\Win32[1].Spy.Pachat.zip\Win32.Spy.Pachat\Win32.Spy.Pachat\pdf_100.scr\[ASProtect]" file.

显示全部楼层 · 发表于 2008-10-4 00:25:12

咖啡 Generic Pws b全灭

显示全部楼层 · 发表于 2008-10-4 00:28:09

kv 0

显示全部楼层 · 发表于 2008-10-4 10:26:06

pdf_100(10).scr_ - Trojan-Downloader.Win32.Delf.oyv,
pdf_100(11).scr_ - Trojan-Downloader.Win32.Delf.oyw,
pdf_100(12).scr_ - Trojan-Downloader.Win32.Delf.oyx,
pdf_100(13).scr_ - Trojan-Downloader.Win32.Delf.oyy,
pdf_100(14).scr_ - Trojan-Downloader.Win32.Delf.oyz,
pdf_100(15).scr_ - Trojan-Downloader.Win32.Delf.oyj,
pdf_100(16).scr_ - Trojan-Downloader.Win32.Delf.oyk,
pdf_100(2).scr_ - Trojan-Downloader.Win32.Delf.oyl,
pdf_100(3).scr_ - Trojan-Downloader.Win32.Delf.oym,
pdf_100(4).scr_ - Trojan-Downloader.Win32.Delf.oyn,
pdf_100(5).scr_ - Trojan-Downloader.Win32.Delf.oyo,
pdf_100(6).scr_ - Trojan-Downloader.Win32.Delf.oyp,
pdf_100(7).scr_ - Trojan-Downloader.Win32.Delf.oyq,
pdf_100(8).scr_ - Trojan-Downloader.Win32.Delf.oyr,
pdf_100(9).scr_ - Trojan-Downloader.Win32.Delf.oys,
pdf_100.scr_ - Trojan-Downloader.Win32.Delf.oyu

显示全部楼层 · 发表于 2008-10-4 12:23:39

这个没漏。全灭

显示全部楼层 · 发表于 2008-10-4 12:57:14

使用 G DATA AntiVirus 进行病毒检测
版本 19.0.0.49 (22.08.2008)
病毒特征库日期 04.10.2008
开始时间: 04.10.2008 12:56
引擎: 引擎 A - BitDefender (AVA 19.662), 引擎 B - Avast! (AVB 19.48)
高启发: 开启
文件: 开启
系统区域: 关闭
RootKits 检测: 开启

检测选中目录和文件:
C:\Documents and Settings\Administrator\桌面\Win32[1].Spy.Pachat\

项目: pdf_100(10).scr
路径: C:\Documents and Settings\Administrator\桌面\Win32[1].Spy.Pachat\Win32.Spy.Pachat\Win32.Spy.Pachat
状态: 发现病毒
病毒: Trojan.Agent.Delf.JZ (引擎 A)
项目: pdf_100(11).scr
路径: C:\Documents and Settings\Administrator\桌面\Win32[1].Spy.Pachat\Win32.Spy.Pachat\Win32.Spy.Pachat
状态: 发现病毒
病毒: Trojan.Agent.Delf.JZ (引擎 A)
项目: pdf_100(12).scr
路径: C:\Documents and Settings\Administrator\桌面\Win32[1].Spy.Pachat\Win32.Spy.Pachat\Win32.Spy.Pachat
状态: 发现病毒
病毒: Trojan.Agent.Delf.JZ (引擎 A)
项目: pdf_100(13).scr
路径: C:\Documents and Settings\Administrator\桌面\Win32[1].Spy.Pachat\Win32.Spy.Pachat\Win32.Spy.Pachat
状态: 发现病毒
病毒: Trojan.Agent.Delf.JZ (引擎 A)
项目: pdf_100(14).scr
路径: C:\Documents and Settings\Administrator\桌面\Win32[1].Spy.Pachat\Win32.Spy.Pachat\Win32.Spy.Pachat
状态: 发现病毒
病毒: Trojan.Agent.Delf.JZ (引擎 A)
项目: pdf_100(15).scr
路径: C:\Documents and Settings\Administrator\桌面\Win32[1].Spy.Pachat\Win32.Spy.Pachat\Win32.Spy.Pachat
状态: 发现病毒
病毒: Trojan.Agent.Delf.JZ (引擎 A)
项目: pdf_100(16).scr
路径: C:\Documents and Settings\Administrator\桌面\Win32[1].Spy.Pachat\Win32.Spy.Pachat\Win32.Spy.Pachat
状态: 发现病毒
病毒: Trojan.Agent.Delf.JZ (引擎 A)
项目: pdf_100(2).scr
路径: C:\Documents and Settings\Administrator\桌面\Win32[1].Spy.Pachat\Win32.Spy.Pachat\Win32.Spy.Pachat
状态: 发现病毒
病毒: Trojan.Agent.Delf.JZ (引擎 A)
项目: pdf_100(3).scr
路径: C:\Documents and Settings\Administrator\桌面\Win32[1].Spy.Pachat\Win32.Spy.Pachat\Win32.Spy.Pachat
状态: 发现病毒
病毒: Trojan.Agent.Delf.JZ (引擎 A)
项目: pdf_100(4).scr
路径: C:\Documents and Settings\Administrator\桌面\Win32[1].Spy.Pachat\Win32.Spy.Pachat\Win32.Spy.Pachat
状态: 发现病毒
病毒: Trojan.Agent.Delf.JZ (引擎 A)
项目: pdf_100(5).scr
路径: C:\Documents and Settings\Administrator\桌面\Win32[1].Spy.Pachat\Win32.Spy.Pachat\Win32.Spy.Pachat
状态: 发现病毒
病毒: Trojan.Agent.Delf.JZ (引擎 A)
项目: pdf_100(6).scr
路径: C:\Documents and Settings\Administrator\桌面\Win32[1].Spy.Pachat\Win32.Spy.Pachat\Win32.Spy.Pachat
状态: 发现病毒
病毒: Trojan.Agent.Delf.JZ (引擎 A)
项目: pdf_100(7).scr
路径: C:\Documents and Settings\Administrator\桌面\Win32[1].Spy.Pachat\Win32.Spy.Pachat\Win32.Spy.Pachat
状态: 发现病毒
病毒: Trojan.Agent.Delf.JZ (引擎 A)
项目: pdf_100(8).scr
路径: C:\Documents and Settings\Administrator\桌面\Win32[1].Spy.Pachat\Win32.Spy.Pachat\Win32.Spy.Pachat
状态: 发现病毒
病毒: Trojan.Agent.Delf.JZ (引擎 A)
项目: pdf_100(9).scr
路径: C:\Documents and Settings\Administrator\桌面\Win32[1].Spy.Pachat\Win32.Spy.Pachat\Win32.Spy.Pachat
状态: 发现病毒
病毒: Trojan.Agent.Delf.JZ (引擎 A)
项目: pdf_100.scr
路径: C:\Documents and Settings\Administrator\桌面\Win32[1].Spy.Pachat\Win32.Spy.Pachat\Win32.Spy.Pachat
状态: 发现病毒
病毒: Trojan.Agent.Delf.JZ (引擎 A)

检测执行时间: 04.10.2008 12:56
已检测 16 个文件
已发现 16 个病毒文件

显示全部楼层 · 发表于 2008-10-4 14:03:39

紅傘：全部都未偵測到
回報

显示全部楼层 · 发表于 2008-10-4 20:47:26

这个PDF的危害是什么动作是什么有谁能解释下吗？

[病毒样本] 伪装的PDFX16

全灭

本帖子中包含更多资源